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IN THE CLAIMS : 

Please cancel claims 2 and 13 without prejudice. 
Please amend claim 1, 12, 21, and 23 as indicated below. 
A listing of the status of all claims 1-24 in the present 
patent application is provided below. 

1 (Currently Amended) . A method for tracing source addresses of 

packets, the method comprising: 

receiving a current packet at a first network element ,- 
identifying at least part of a source address of the 

current packet; 

querying a storage module of the first network element to 
identify at least one source address of a previously received 
packet , wherein the at least one source address of the 
previously received packet is recorded in a hierarchical data 
structure and the hierarchical data structure is based at least 
in part on a plurality of classes of subnet ; 

determining whether the at least part of the source address 
of the current packet matches at least part of the at least one 
source address of the previously received packet; and 

routing the current packet to a second network element if 
the at least part of the source address of the current packet 
matches at least part of the at least one source address of the 
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previously received packet. 

2 (Cancelled) . 

3 (Previously Presented) . The method according to claim 1, 
where a Last Time Seen (LTS) value associated with each of the 
at least one source address of the previously received packet is 
recorded. 

4 (Previously Presented) . The method according to claim 1, 
further comprising: 

recording an arrival time of the packet. 

5 (Previously Presented) . The method according to claim 1, 
further comprising: 

routing the current packet to the second network element 
with a warning if the at least part of the source address of the 
current packet does not match at least part of the at least one 
source address of the previously received packet; and 

recording the at least part of the source address of the 
current packet and reception time of the current packet. 

6 (Original) . The method according to claim 5, where the 

3 

57983.000166 EMFJJS 26495197V1 



U.S. Patent Application No.: 10/721,335 
Attorney Docket No.: 57983.000166 
Client Reference No.: 16399ROUS01U 

warning is recorded in a read-only medium. 

7 (Previously Presented) . The method according to claim 1, 
further comprising issuing a warning and discarding the current 
packet if the at least part of the source address of the current 
packet does not match at least part of the at least one source 
address of the previously received packet. 

8 (Original). The method according to claim 7, where the 
warning is recorded in a read-only medium. 

9 (Previously Presented) . The method according to claim 1, 
where the source address of the current packet is an internet 
protocol (IP) address. 

10 (Cancelled) . 

11 (Previously Presented) . At least one processor readable 
storage medium for storing a computer program of instructions 
configured to be readable by at least one processor for 
instructing the at least one processor to execute a computer 
process for performing the method as recited in claim 1. 
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12 (Currently Amended) . A system for tracing source addresses 

of packets comprising a first network element for receiving a 

current packet, where the first network element comprises: 

a processor module that identifies at least part of a 

source address of the current packet, queries to identify at 

least one source address of a previously received packet^ 

wherei n the at least one source address of the previously 

received packet is recorded in a hierarchical data structure and 

the hierarchical data structure comprises a plurality of classes 

of subnet , determines whether the at least part of the source 

address of the current packet matches at least part of the at 

least one source address of the previously received packet, and 

routes the current packet to a second network element if the at 

least part of the source address of the current packet matches 

at least part of the at least one source address of the 

previously received packet; and 

a storage module that stores the at least one source 

address of the previously received packet. 

13 (Cancelled) . 

14 (Previously Presented). The system according to claim 12, 
where a Last Time Seen (LTS) value associated with each of the 
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at least one source address of the previously received packet is 

recorded. 



15 (Previously Presented). The system according to claim 12, 
where the processor module is further adapted to record 
reception time of the current packet. 

16 (Previously Presented) . The system according to claim 12, 
where the processor module is further adapted to: 

route the current packet to the second network element with 
a warning if the at least part of the source address of the 
current packet does not match at least part of the at least one 
source address of the previously received packet; and 

record the at least part of the source address of the 
current packet and reception time of the current packet. 

17 (Original). The system according to claim 16, where the 
warning is recorded in a read-only medium. 

18 (Previously Presented) . The system according to claim 12, 
where the processor module is further adapted to issue a warning 
and discard the current packet if the at least part of the 
source address of the current packet does not match at least 
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part of the at least one source address of the previously 

received packet. 

19 (Original) . The system according to claim 18, where the 
warning is recorded in a read-only medium. 

20 (Previously Presented). The system according to claim 12, 
where the source address of the current packet is an internet 
protocol (IP) address. 

21 (Currently Amended) . A system for tracing source addresses 
of packets, the system comprising: 

means for receiving a current packet at a first network 
element; 

means for identifying at least part of a source address of 
the current packet; 

means for querying a storage module to identify at least 
one source address of a previously received packet , wherein the 
at least one source address of the previously received packet is 
recorded in a hierarchical data structure and the hierarchical 
data structure comprises a plurality of classes of subnet ; 

means for determining whether the at least part of the 
source address of the current packet matches at least part of 

7 

57983.000166 EMF_US 26495197vl 



U.S. Patent Application No. : 10/721,335 
Attorney Docket No.: 57983.000166 
Client Reference No.: 16399ROUS01U 

the at least one source address of the previously received 

packet; and 

means for routing the current packet to a second network 
element if the at least part of the source address of the 
current packet matches at least part of the at least one source 
address of the previously received packet. 



22 (Previously Presented). The method according to claim 1, 
wherein the at least one source address of the previously 
received packet is recorded within a predetermined time period 
prior to receiving the current packet. 

23 (Currently Amended) . The method according to claim SI, 
wherein the plurality of classes of subnet comprises at least 
one of a class A subnet, a class B subnet, and a class C subnet, 
wherein the class A subnet comprises a first octet of the at 
least one source address recorded, the class B subnet comprises 
a second octet of the at least one source address recorded, and 
the class C subnet comprises a third octet of the at least one 
source address recorded. 



24 (Previously Presented) . The method according to claim 23, 
wherein determining whether the at least part of the source 
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address of the current packet matches at least part of the at 

least one source address of the previously received packet 

comprises comparing the at least part of the source address of 

the current packet with at least one of the plurality of classes 

of subnet of the at least one source address of the previously 

received packet. 
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